CVE-2025-66484
MediumCVSS 5.5Exploitation Probability (EPSS)
Low risk8th percentile - higher than 8% of all known CVEs
Summary
IBM Aspera Shares 1.9.9 through 1.11.0 is vulnerable to stored cross-site scripting. This vulnerability allows users to embed arbitrary JavaScript code in the Web UI, thus altering the intended functionality and potentially leading to credentials disclosure within a trusted session.
Risk Assessment
The risk includes the possibility of stealing user credentials and compromising the integrity of the web interface, which may lead to unauthorized access to the system.
Recommendation
It is recommended to upgrade IBM Aspera Shares to a version newer than 1.11.0 that includes the fix, and to implement security policies that restrict users' ability to inject scripts.
Other vulnerabilities in IBM Aspera Shares
See all- CVE-2025-66487Low
IBM Aspera Shares 1.9.9 through 1.11.0 does not properly rate limit the frequency that an authenticated user can send emails, which could result in email flooding or a denial of service.
- CVE-2025-66486Medium
IBM Aspera Shares versions 1.9.9 through 1.11.0 are vulnerable to HTML injection. A remote attacker could inject malicious HTML code, which when viewed, would be executed in the victim's Web browser within the security context of the hosting site.
- CVE-2025-66485Medium
IBM Aspera Shares versions 1.9.9 through 1.11.0 is vulnerable to HTTP header injection caused by improper validation of the HOST header. This could allow an attacker to conduct various attacks, including cross-site scripting, cache poisoning, or session hijacking.
- CVE-2025-66483Medium
In IBM Aspera Shares versions 1.9.9 through 1.11.0, sessions are not invalidated after a password reset, which could allow an authenticated user to impersonate another user on the system.
- CVE-2025-13916Medium
IBM Aspera Shares versions 1.9.9 through 1.11.0 use weaker than expected cryptographic algorithms, which could allow an attacker to decrypt highly sensitive information.
Original NVD description (English source)
IBM Aspera Shares 1.9.9 through 1.11.0 is vulnerable to stored cross-site scripting. This vulnerability allows users to embed arbitrary JavaScript code in the Web UI thus altering the intended functionality potentially leading to credentials disclosure within a trusted session.
Vulnerability data from NVD (NIST) · CISA KEV · EPSS